Ruby on Rails - When to use params.permit! and how to replace it

Question

I'm working on a legacy rails application and the controllers have many instances of params.permit!. When running a Brakeman scan on it, params.permit! opens up the application to mass assignment vulnerabilities.

My question is- what is the most effective way to get around this params.permit! vulnerability and replace it?

Pavan · Accepted Answer · 2018-09-17T20:00:02.187

params.permit! whitelists all attributes leading to the vulnerabilities of mass assignment. The best way to get around this is by whitelisting only the necessary attributes like so

params.permit(:attr1,:attr2..)

Even better, use require with permit

Allows you to choose which attributes should be whitelisted for mass updating and thus prevent accidentally exposing that which shouldn't be exposed. Provides two methods for this purpose: require and permit. The former is used to mark parameters as required. The latter is used to set the parameter as permitted and limit which attributes should be allowed for mass updating.

params.require(:key).permit(:attr1, :attr2..)

Sorry I forgot to answer sooner! This pretty much answered my question. Thanks — zasman, Sep 25 '18 at 21:41

score 3 · Answer 2 · answered Sep 17 '18 at 19:49

3

I assume that someone added the params.permit! after a rails upgrade to avoid looking into "strong parameters" and setting it up correctly.

The correct way to fix this is by going through every controller and reviewing what params you need and want to permit for every action, and then using params.permit (without the exclamation mark) to set up the whitelist for permitted paramters:

https://apidock.com/rails/ActionController/Parameters/permit

answered Sep 17 '18 at 19:49

trueunlessfalse

1,163
10
16

That sounds like something that may have happened. So, params.permit(:attribute1, :attribute2) before each method? – zasman Sep 17 '18 at 20:12
First, Pavans answer is more complete and quicker then mine. I would recommend to select it as the correct answer. Second: In most cases a crud-controller has only two actions using the params: update and create. Often (not always!) both actions are permitting the same parameters, so in a controller for a 'person' defining 'person_params' once should be enough. – trueunlessfalse Sep 18 '18 at 07:50
I would recomend you to read the rails guide for strong parameters: https://edgeguides.rubyonrails.org/action_controller_overview.html#strong-parameters – trueunlessfalse Sep 18 '18 at 07:51

score 1 · Answer 3 · answered Oct 29 '18 at 14:54

1

I also found that using the to_unsafe_hash method on individual param calls will work and get around the Brakeman warning. Some info on the method here: https://apidock.com/rails/v4.2.7/ActionController/Parameters/to_unsafe_hash

answered Oct 29 '18 at 14:54

zasman

446
1
8
28

Ruby on Rails - When to use params.permit! and how to replace it

3 Answers3